Some kid is phishing for Ebay accounts and CCs

LeoZ 2005-02-03 08:18:51 ET Whoops. I've been told that the wbe page in question carries a virus. A DNS lookup on that IP address reveals him (it might be a her though) to be: pcp08759342pcs.mtlrel01.nj.comcast.net So he has Comcast cable and lives in New Jersey. The genius seems to be running the fake site off his home computer.

Venadium 2005-02-03 09:20:40 ET Or he could be running it from someone else's home computer without their knoledge.

LeoZ 2005-02-03 09:27:37 ET But since this site's been up for a while I don't think so unless the owned computer never gets shut off.

Venadium 2005-02-03 09:32:05 ET Yea I dunno, it's a Debian box which set up as a web server. It's odd that whoever put the site up hid it in the images directory though, like they were even trying to hide it from the owner.

LeoZ 2005-02-03 09:38:44 ET Ah. I didn't try logging into it. Yeah, it's probably an owned box then.

tetesuro 2005-02-03 10:15:54 ET Yeah, I've done that with Yahoo accounts but me and a friend were pretty fancy about it.

tetesuro 2005-02-03 10:16:42 ET How does lure his victims? DNS spoofing?

LeoZ 2005-02-03 10:18:26 ET No, no, it's email phishing. You know, "We have lost your account information blah blah blah. Go to this site and clear everything up."

tetesuro 2005-02-03 10:19:48 ET Oh, right.

Return to LeoZ's page